release: v0.2.0 — the graduation (direct op + bind-first/forwarded metadata flow)

- README sync: the direct op (ADR-007), the bind-first establisher +
  the forwarded op (ADR-008), TunnelListener + the reply-field
  projection, the 0.2 summary section, the local bind-first helpers
- CHANGELOG: Unreleased cut to 0.2.0 (the graduation + the alkcall
  0.8.0 bump; compare links updated)
- Cargo.toml: 0.1.0 -> 0.2.0

Verification: cargo test (135 pass default / 162 with local), clippy
(all targets, -D warnings, both feature sets), fmt, doc, the
wasm32-unknown-unknown check + clippy, and cargo publish --dry-run
--allow-dirty all green

CHANGELOG.md

@@ -6,8 +6,11 @@ this crate adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
-The graduation implementation (the direct op, listen metadata + the
-forwarded op — ADRs 007/008) landed — see Added below.
+## [0.2.0] - 2026-09-20
+
+The graduation release: the direct op + the bind-first/forwarded
+metadata flow (ADRs 007/008), over alkcall 0.8.0. Composed against by
+alksocks (the SOCKS5 layer) and the planned `alknodes` assembly.
 
 ### Added
 
@@ -218,5 +221,6 @@ complete (Phase 2, review 001 findings remediated).
   matrix). Wasm-clean default crate verified (`wasm32-unknown-unknown`
   check + clippy).
 
-[Unreleased]: https://git.alk.dev/alkdev/alktunnels/compare/v0.1.0...HEAD
+[Unreleased]: https://git.alk.dev/alkdev/alktunnels/compare/v0.2.0...HEAD
+[0.2.0]: https://git.alk.dev/alkdev/alktunnels/compare/v0.1.0...v0.2.0
 [0.1.0]: https://git.alk.dev/alkdev/alktunnels/releases/tag/v0.1.0